How to calculate the index size from all indexers

[adityapavan18]

Is there a way to calculate total size of an index from all indexers?
I can see index size from each individual indexer but i have around 30 indexers in the setup i am working on..so ideally wouldn't work if go and check index size in each indexer individually

[alacercogitatus · Accepted solution]

Building on MuS' answer, you can do each indexer from a single search head. This will require SoS to be installed ( http://apps.splunk.com/app/748/ ).

| inputlookup splunk_servers_cache | search server_role="search-peer" | map maxsearches=100 search="| rest /services/data/indexes splunk_server=$sos_server$ " | stats sum(currentDBSizeMB) by title splunk_server

Each of these calls should be really quick, so the number of search-peers will increase execution time, but not as badly as if you were doing a data search.

You can also adjust the stats do whatever you need, | stats sum(currentDBSizeMB) by title.

[MuS]

Just came along this old post, happy to give some karma to an old friend 

😊

[dtrelford]

SoS is discontinued and no longer supported. Is there an alternative query that can be run now?

My apologies if I should have posted this in a new question.

[gjanders]

| rest /services/data/indexes |  stats sum(currentDBSizeMB) by title splunk_server

The above might do it, you can use the REST API or use the monitoring console. The monitoring console has a variety of queries that do this which you can borrow by clicking on the magnifying glass (it replaces SoS)

[alacercogitatus]

You can even summarize this (with |collect index=summary) and then do data capacity planning!

[adityapavan18]

Thanx a lot...I do have S.o.S installed..and running this query provided me the data i require

[MHibbin]

The eventcount command may be what you need:

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Eventcount

Haven't tried it against multiple indexers however.

This command requires a "|" before the command to run.

Hope this helps.

[MHibbin]

@adityapavan18, again I'm not sure, as I only one indexer to play around with at the moment, but perhaps the following, seems odd to me that it has the server field if it is localized to one server...

| eventcount summarize=false index=* report_size=true | eval MB=(size_bytes/1024)/1024 | stats sum(MB) by index, server

[aokur_splunk]

worked for me - thanks MHibbin

[mendesjo]

Nope doesn't work..

[adityapavan18]

this helps only for a particular indexer.Not sure how we use for multiple indexers

[MuS]

Hi adityapavan18

one way would be to use the REST endpoint /services/data/indexes for that, but this must be done against each indexer. Personally I would setup a summarized saved search on each indexer which runs the following search:

     | rest /services/data/indexes | stats values(currentDBSizeMB) by title

This way you will be able to get the index size for each indexer with one single search afterwards.

hope this helps ...

cheers, MuS

[awurster]

this is way better, as anything that requires the 3rd party app like SOS is not a clean one IMHO. i think more and more of these weird little tasks must be phased out and worked into core splunk (via REST API for instance or DMC moving forward.

[adityapavan18]

Thanx MuS.

[mendesjo]

| rest /services/data/indexes | stats values(currentDBSizeMB) by title

That only provides data of index per indexer, it's not added up.. How would you sum it?

[MuS]

Quick and dirty solution is to run this:

 | rest /services/data/indexes | where totalEventCount!=0 | stats values(currentDBSizeMB) AS size by title | streamstats sum(size) AS total

[sowings]

Note that currentDBsizeMB is 1 for an index with no events. Might want to filter out those where totalEventCount=0

[MuS]

Good point, I changed the search - thanks 😉

[Rocky31]

what you changed? paste it here plz

[Muryoutaisuu]

why not just use | stats sum(currentDBSizeMB) by title

instead of values?